Organizations often focus on promoting best practices, CISA says, but stopping poor security practices is equally important.